Security model

Fail closed

Unknown domains, undeclared capabilities, missing secrets, invalid requests, unsafe redirects and policy-violating outbound requests are all refused rather than guessed. This is the default posture, not a configuration flag.

Secret memory

Application secret types are:

• non-serializable — they cannot be turned into JSON, CBOR or any wire format;
• page-locked (mlock) and excluded from core dumps;
• budgeted — total locked secret memory is bounded;
• zeroized on drop;
• redacting in every Debug and Display path; and
• absent from template JSON — the request-scoped projection exposes secret values only through a controlled path that zeroizes them after render.

Error handlers get a public-only projection. Deploy paths move secrets into the long-lived SecretGeneration and leave an empty generation behind.

Transport and authority

The public origin is HTTP behind a trusted proxy that owns TLS. Authority resolution uses strict RFC 7239 / X-Forwarded-* parsing with exact-hop selection, cardinality-consistent lists, and UTS-46 / DNS canonicalization. Untrusted peers cannot influence which tenant serves a request. HTTP parsing and response headers are hardened against smuggling and header injection.

Outbound (SSRF) policy

Every capability adapter calls one policy-enforcing executor. It parses the URL and rejects bad schemes, userinfo and ports; rejects private, loopback, link-local and metadata address ranges by default; ignores ambient proxy environment unless operator policy allows it; bounds request and response bodies; and re-validates on every redirect. Blocked requests surface as security.ssrf_blocked.

CSRF and mutation boundaries

Safe methods never mutate. Mutating routes must declare their methods in the manifest, and cross-origin state-changing requests are rejected unless they carry a verified token.

Release supply chain

The release is built twice and compared for reproducibility, gated on RustSec advisories and a license / source / yanked-dependency policy, checked for critical HTTP and crypto dependency duplication, and packaged as auditable signed evidence.

Deliberate loss of volatile secrets

Crisptastic never persists application secrets. Complete loss of volatile secret state is intentional: recovery requires reinjection. This keeps archived Capsules and any leaked storage free of usable credentials.